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Amendments -fco -fche Claims : 

This listing of claims will replace all prior 
versions, and listings, of claims in the application: 

Listing of Claims : 

Claims 1-46 (cancelled) 

47. (New) A method for collecting information 
relating to a communication network, the method comprising: 

detecting data conveyed by detected nodes operating 
in the communication network in a manner that is transparent 
to the detected nodes; 

analyzing detected data for identifying nodal 
information relating to the detected nodes and for identifying 
missing information; and querying one or more queried nodes 
for the missing information , 

48. (New) The method of Claim 47. wherein: 

there are received other data relating to the 
communication network; 

and 

the analyzing detected date analyzes also the other 
data for identifying the missing information. 
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49. (New) The method of Claim 47, wherein the nodal 
information includes operating system information relating to 
operating systems operating on nodes. 

50. (New) The method of Claim 49, wherein the nodes 
are included in at least one of the following: detected nodes 
and queried nodes. 

51. (New) The method of Claim 49, wherein 
detecting data includes detecting at least one type of message 
from a group including DHCP (Dynamic Host Configuration 
Protocol) messages and SYN packets. 

52. (New) The method of Claim 49, wherein analyzing 

includes : 

receiving data corresponding to data conveyed by a 
detected node; inspecting received data for characteristics of 
a known operating system; and 

if inspecting reveals that the data conforms with the 
characteristics, indicating that the known operating system 
operates on the detected node . 

53. (New) The method of Claim 47, wherein the nodal 

information includes runtime information relating to running 
processes . 
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54. (New) The method of Claim 53, wherein runtime 
information relating to running processes include at least 
one from the following: information relating to network 
running processes operating on the detected nodes and 
information relating to local running processes operating on 
the detected nodes. 

55. (New) The method of Claim 47, wherein the 
nodal information includes hardware information relating to 
hardware components associated with the respective detected 
nodes - 

56. (New) The method of Claim 47, wherein the nodal 
information includes topology of the communication network. 

57. (New) The method of Claim 47, wherein querying 

includes : 

generating a query message corresponding to the 
missing information for sending to queried nodes. 

58. (New) The method of Claim 57, wherein querying 
further includes: 

receiving at least one response that corresponds to the query 
message; and 

processing the at least one response to retrieve 
information corresponding to the missing information. 
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59. (New) The method of Claim 57, wherein the query 
message is one of the following: an ARP (Address Resolution 
Protocol) request, an ICMP (Internet Control Message 
Protocol) echo request and a TCP-SYN request. 

60. (New) The method of Claim 57, wherein generating 
is done in accordance with a test policy and wherein the test 
policy is selected from a group of available test policies. 

61. (New) The method of Claim 57, wherein generating 
is done in accordance with a test policy and wherein the test 
policy is selected in accordance with a statistical 
computation . 

62. (New) The method of Claim 57, wherein said 
missing information relates to at least one running process 
operating on respective queried nodes. 

63. (New) The method of Claim 57, wherein detected 
nodes include at lease one queried node and the date conveyed 
by detected nodes includes at least on response that 
corresponds to the query message. 

64. (New) A network information collector for 
collecting information relating to a communication network, 
the system comprising: 
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a network detector for detecting data conveyed by 
detected nodes operating in the communication network in a 
manner that is transparent to the detected nodes; 

an analyzer for analyzing detected data for 
identifying nodal information relating to the detected nodes 
and for identifying missing information; and 

a query engine for querying one or more nodes 
queried nodes for the missing information. 

65. (New) The network information collector of Claim 
64, further including; 

an input device for receiving other data relating to the 
communication network; and 

wherein the analyzer is configured to analyze also the 
other data for identifying the missing information. 

66. (New) The network information collector of Claim 
64, wherein the analyzer is configured to analyze nodal 
information that includes operating system information 
relating to operating systems operating on detected nodes. 

67. (New) The information collector of Claim 66, 
wherein detecting data conveyed by the detected nodes 
includes detecting at least one type of message from a group 
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including DHCP (Dynamic Host Configuration Protocol) messages 
and SYN packets. 

68. (New) the network information collector of Claim 
66, wherein analyzer includes: 

an input for receiving data, the data corresponds to 
data conveyed by a detected node; 

a data inspector coupled to said input device, the data 
inspector being configured to inspect received data for 
characteristics of a known operating system; and 

a data marker coupled to said data inspector and being 
responsive thereto, the data marker being configured to 
indicate that the known operating system ooperates on the 
detected node. 

69. (New) The network information collector of Claim 
64, wherein the analyzer is configured to analyze nodal 
information that includes runtime information relating to 
running processes . 

70. (New) The network information collector of Claim 
64, wherein the query engine includes: 

a query message generator for generating a query 
message corresponding to the missing information; and 
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an output device for conveying the query message to 
the queried nodes. 

71. (New) The network information collector of 
Claim 70, wherein the query engine further includes: 

an input device for receiving at least one response 
that corresponds to the query message; and 

a response processor for processing the at least one 
response to retrieve information corresponding to the missing 
information. 

72. (New) A program storage device readable by 
machine, tangibly embodying a program of instructions 
executable by the machine to perform method for collecting 
information relating to a communication network, the method 
comprising : 

detecting data conveyed by detected nodes operating 
in the communication network in a manner that is transparent 
to the detected nodes; 

analyzing detected data for identifying nodal 
information relating to the detected nodes and for 
identifying missing information; and 

querying one or more queried nodes for the missing 
information . 
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73. (New) A computer program product comprising a 
computer useable medium having computer readable program code 
embodied therein for collecting information relating to a 
communication network, the computer program product 
comprising : 

computer readable program code for causing the 
computer to detect data conveyed by detected nodes operating 
in the communication network in a manner that is transparent 
to the detected nodes; 

computer readable program code for causing the 
computer to analyze detected data for identifying nodal 
information relating to the detected nodes for identifying 
missing information; and 

computer readable program code for causing the 
computer to query one or more queried nodes for the missing 
information . 
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